POST/api/oidc/revokePublic

Token revocation

The OAuth 2.0 token revocation endpoint (RFC 7009), advertised as revocation_endpoint. A client POSTs a token issued to it and the token stops working: a refresh token can no longer be redeemed, and the access tokens minted alongside it (in the same token response) are revoked with it; an oidc-userinfo access token is refused by /api/oidc/userinfo and reported inactive by introspection; a delegated access token (RFC 8693 act, from the token exchange grant) is reported inactive by its API server's introspection, so a client ends an agent's access when the agent's session ends. Other access tokens minted for an API server (an RFC 8707 resource) are answered with unsupported_token_type: revoke the refresh token they were issued with. A token that is not a live token of this server (malformed, expired or already revoked) also yields 200, as §2.2 requires, while a live token issued to another client is refused with invalid_grant. The success response has an empty body and Cache-Control: no-store; every response carries Access-Control-Allow-Origin: * (no cookies are read).

operationId post_api_oidc_revokeOpenID Connect / OAuth 2.0

Authentication & permissionsPublic

Anyone — no credentials required

Accepted credentials: None required
Notes: Client authentication as at the token endpoint (RFC 7009 §2.1): a confidential client (an app with a registered client secret) MUST authenticate with client_secret_basic (HTTP Basic Authorization header) or client_secret_post (client_secret form field); a public client identifies itself with client_id alone. The handler performs this itself.

Request body

Required

application/x-www-form-urlencoded

OidcRevocationRequest

Property	Type	Description
token*	string	REQUIRED. The refresh token or access token to revoke.
token_type_hint	"access_token" \| "refresh_token"	Accepted but unused: the token kind is read from the token itself.
client_id	string	The client the token was issued to. A public client identifies itself with it alone; a confidential client may send it in its HTTP Basic credentials instead. minLength: 2maxLength: 64pattern: ^[a-z0-9_-]*$
client_secret	string	`client_secret_post` authentication, for confidential clients.

Responses

Header	Type	Description
Cache-Control	string

Example request

bashcurl

curl -X POST 'https://auth.schemavaults.com/api/oidc/revoke' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'token=string' \
  --data-urlencode 'token_type_hint=access_token' \
  --data-urlencode 'client_id=string' \
  --data-urlencode 'client_secret=string'

Authentication & permissionsPublic

Request body

Responses

200The token was revoked, or was not a live token of this server (empty body)no body

400Not form-encoded, token missing, a malformed Basic Authorization header or both client authentication methods (invalid_request); an access token minted for an API server that is not a delegated token (unsupported_token_type); a live token issued to another client (invalid_grant)

401No or a malformed client_id, an unknown client, a confidential client without its secret or with a wrong one, or a secret sent for a public client (invalid_client)

500The revocation request could not be processed (server_error)

Example request